README

   1 1) Reference Policy make targets:
   2
   3 General Make targets:
   4
   5 install-src             Install the policy sources into
   6                         /etc/selinux/NAME/src/policy, where NAME is defined in
   7                         the Makefile.  If not defined, the TYPE, as defined in
   8                         the Makefile, is used.  The default NAME is refpolicy.
   9                         A pre-existing source policy will be moved to
  10                         /etc/selinux/NAME/src/policy.bak.
  11
  12 conf                    Regenerate policy.xml, and update/create modules.conf
  13                         and booleans.conf.  This should be done after adding
  14                         or removing modules, or after running the bare target.
  15                         If the configuration files exist, their settings will
  16                         be preserved.  This must be ran on policy sources that
  17                         are checked out from the CVS repository before they can
  18                         be used.
  19
  20 clean                   Delete all temporary files, compiled policies,
  21                         and file_contexts.  Configuration files are left intact.
  22
  23 bare                    Do the clean make target and also delete configuration
  24                         files, web page documentation, and policy.xml.
  25
  26 html                    Regenerate policy.xml and create web page documentation
  27                         in the doc/html directory.
  28
  29 Make targets specific to modular (loadable modules) policies:
  30
  31 base                    Compile and package the base module.  This is the
  32                         default target for modular policies.
  33
  34 modules                 Compile and package all Reference Policy modules
  35                         configured to be built as loadable modules.
  36
  37 MODULENAME.pp           Compile and package the MODULENAME Reference Policy
  38                         module.
  39
  40 all                     Compile and package the base module and all Reference
  41                         Policy modules configured to be built as loadable
  42                         modules.
  43
  44 install                 Compile, package, and install the base module and
  45                         Reference Policy modules configured to be built as
  46                         loadable modules.
  47
  48 load                    Compile, package, and install the base module and
  49                         Reference Policy modules configured to be built as
  50                         loadable modules, then insert them into the module
  51                         store.
  52
  53 validate                Validate if the configured modules can successfully
  54                         link and expand.
  55
  56 Make targets specific to monolithic policies:
  57
  58 policy                  Compile a policy locally for development and testing.
  59                         This is the default target for monolithic policies.
  60
  61 install                 Compile and install the policy and file contexts.
  62
  63 load                    Compile and install the policy and file contexts, then
  64                         load the policy.
  65
  66 enableaudit             Remove all dontaudit rules from policy.conf.
  67
  68 relabel                 Relabel the filesystem.
  69
  70 checklabels             Check the labels on the filesystem, and report when
  71                         a file would be relabeled, but do not change its label.
  72
  73 restorelabels           Relabel the filesystem and report each file that is
  74                         relabeled.
  75
  76
  77 2) Reference Policy Build Options (build.conf)
  78
  79 TYPE                    String.  Available options are strict, targeted,
  80                         strict-mls, targeted-mls, strict-mcs, and targeted-mcs.
  81                         This sets the policy type as strict or targeted, and
  82                         optionally enables multi-leve security (MLS) or
  83                         multi-category security (MCS) features.  This option
  84                         controls strict_policy, targeted_policy, enable_mls,
  85                         and enable_mcs policy blocks.
  86
  87 NAME                    String (optional).  Sets the name of the policy; the
  88                         NAME is used when installing files to e.g.,
  89                         /etc/selinux/NAME and /usr/share/selinux/NAME.  If not
  90                         set, the policy type (TYPE) is used.
  91
  92 DISTRO                  String (optional).  Enable distribution-specific policy.
  93                         Available options are redhat, rhel4, gentoo, debian,
  94                         and suse.  This option controls distro_redhat,
  95                         distro_rhel4, distro_gentoo, distro_debian, and
  96                         distro_suse policy blocks.
  97
  98 MONOLITHIC              Boolean.  If set, a monolithic policy is built,
  99                         otherwise a modular policy is built.
 100
 101 DIRECT_INITRC           Boolean.  If set, sysadm will be allowed to directly
 102                         run init scripts, instead of requiring the run_init
 103                         tool.  This is a build option instead of a tunable since
 104                         role transitions do not work in conditional policy.
 105                         This option controls direct_sysadm_daemon policy
 106                         blocks.
 107
 108 POLY                    Boolean.  If set, policy for polyinstantiated
 109                         directories will be enabled.  This option controls
 110                         enable_polyinstantiation policy blocks.
 111
 112 OUTPUT_POLICY           Integer.  Set the version of the policy created when
 113                         building a monolithic policy.  This option has no effect
 114                         on modular policy.
 115
 116 QUIET                   Boolean.  If set, the build system will only display
 117                         status messages and error messages.  This option has no
 118                         effect on policy.
 119
 120
 121 3) Reference Policy Files and Directories
 122 All directories relative to the root of the Reference Policy sources directory.
 123
 124 Makefile                General rules for building the policy.
 125
 126 Rules.modular           Makefile rules specific to building loadable module
 127                         policies.
 128
 129 Rules.monolithic        Makefile rules specific to building monolithic policies.
 130
 131 build.conf              Options which influence the building of the policy,
 132                         such as the policy type (strict, targeted, etc.)
 133                         and distribution.
 134
 135 config/appconfig-*      Application configuration files for all configurations
 136                         of the Reference Policy (targeted/strict with or without
 137                         MLS or MCS).  These are used by SELinux-aware programs.
 138
 139 config/local.users      The file read by load policy for adding SELinux users
 140                         to the policy on the fly.
 141
 142 doc/html/*              This contains the contents of the in-policy XML
 143                         documentation, presented in web page form.
 144
 145 doc/policy.dtd          The doc/policy.xml file is validated against this DTD.
 146
 147 doc/policy.xml          This file is generated/updated by the conf and html make
 148                         targets.  It contains the complete XML documentation
 149                         included in the policy.
 150
 151 doc/templates/*         Templates used for documentation web pages.
 152
 153 policy/booleans.conf    This file is generated/updated by the conf make target.
 154                         It contains the booleans in the policy, and their
 155                         default values.  If tunables are implemented as
 156                         booleans, tunables will also be included.  This file
 157                         will be installed as the /etc/selinux/NAME/booleans
 158                         file.
 159
 160 policy/constraints      This file defines additional constraints on permissions
 161                         in the form of boolean expressions that must be
 162                         satisfied in order for specified permissions to be
 163                         granted.  These constraints are used to further refine
 164                         the type enforcement rules and the role allow rules.
 165                         Typically, these constraints are used to restrict
 166                         changes in user identity or role to certain domains.
 167
 168 policy/global_booleans  This file defines all booleans that have a global scope,
 169                         their default value, and documentation.
 170
 171 policy/global_tunables  This file defines all tunables that have a global scope,
 172                         their default value, and documentation.
 173
 174 policy/flask/initial_sids  This file has declarations for each initial SID.
 175
 176 policy/flask/security_classes  This file has declarations for each security class.
 177
 178 policy/flask/access_vectors  This file defines the access vectors.  Common
 179                         prefixes for access vectors may be defined at the
 180                         beginning of the file.  After the common prefixes are
 181                         defined, an access vector may be defined for each
 182                         security class.
 183
 184 policy/mcs              The multi-category security (MCS) configuration.
 185
 186 policy/mls              The multi-level security (MLS) configuration.
 187
 188 policy/modules/*        Each directory represents a layer in Reference Policy
 189                         all of the modules are contained in one of these layers.
 190
 191 policy/modules.conf     This file contains a listing of available modules, and
 192                         how they will be used when building Reference Policy. To
 193                         prevent a module from  being used, set the module to
 194                         "off".  For monolithic policies, modules set to "base"
 195                         and "module" will be included in the policy.  For
 196                         modular policies, modules set to "base" will be included
 197                         in the base module; those set to "module" will be
 198                         compiled as individual loadable modules.
 199
 200 policy/rolemap          This file contains prefix and user domain type that
 201                         corresponds to each user role.  The contents of this
 202                         file will be used to expand the per-user domain
 203                         templates for each module.
 204
 205 policy/support/*        Support macros.
 206
 207 policy/users            This file defines the users included in the policy.
 208
 209 support/*               Tools used in the build process.